Data processing agreement (DPA)

Draft document. Structure and product facts are in place; content marked [TO BE COMPLETED] must be reviewed by counsel before publication. This page is noindex until finalized.

1. Subject and nature of processing

The client (controller) entrusts CallSea (processor) with processing data contained in call recordings for transcription and automatic quality evaluation: ingestion (SFTP/API), transcription, text-based scoring by language models, storage of transcripts and results, and access for the client’s authorized users. Audio recordings are not stored permanently.

2. Data subjects and categories

Data subjects: the client’s agents and their interlocutors. Categories: voice (during transcription), conversation content, agent identifiers, evaluation results. [TO BE COMPLETED: special categories, if present.]

3. Sub-processors

Hosting and infrastructure — data centers in Germany. [TO BE COMPLETED: provider]
Speech-to-text — EU-region processing. [TO BE COMPLETED: provider and region]
Language models (content scoring) — EU-region endpoints; data is not used to train models made available to other parties. [TO BE COMPLETED: providers and regions]

The current named list with locations is a contract annex. [TO BE COMPLETED: notification period for changes.]

4. Technical and organizational measures

Three-level access control, user authentication, client data separation, operation logging. [TO BE COMPLETED: encryption at rest/in transit, backups, personnel access policy.]

5. Retention and deletion

Transcripts and results are stored for the contract term or shorter, per client configuration; upon termination data is deleted or returned as instructed. [TO BE COMPLETED.]

6. Audit and cooperation

CallSea supports the client’s obligations under Art. 32–36 GDPR, including DPIA input (also as required by Art. 26(9) EU AI Act). [TO BE COMPLETED.] Last updated: [TO BE COMPLETED].